apps/ffmpeg-rockchip
1
0
Fork 0
mirror of https://github.com/nyanmisaka/ffmpeg-rockchip.git synced 2025-10-31 04:26:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

avutil/frame: Copy size=0 side data in ff_init_buffer_info()

Browse Source 
Fixes null pointer dereference
Fixes: 189/FOO

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2016-11-16 20:32:26 +01:00
parent 3c0328d58d
commit 2acee08a4a
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavutil/frame.c
View File

@@ -349,6 +349,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
wipe_side_data(dst); wipe_side_data(dst);
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
} }
if (sd_src->buf) {
sd_dst->buf = av_buffer_ref(sd_src->buf); sd_dst->buf = av_buffer_ref(sd_src->buf);
if (!sd_dst->buf) { if (!sd_dst->buf) {
wipe_side_data(dst); wipe_side_data(dst);
@@ -356,6 +357,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
} }
sd_dst->data = sd_dst->buf->data; sd_dst->data = sd_dst->buf->data;
sd_dst->size = sd_dst->buf->size; sd_dst->size = sd_dst->buf->size;
}
} }
av_dict_copy(&sd_dst->metadata, sd_src->metadata, 0); av_dict_copy(&sd_dst->metadata, sd_src->metadata, 0);
} }